South Korean authorities have dismantled a sophisticated XRP staking fraud that siphoned $8.5 million from 71 investors in just eight days, exposing how convincingly crafted fake projects can exploit retail traders seeking yield in the crypto market.
According to reporting by Seoul police, the scheme centred on a fraudulent website—Fxrpntwork.com—that impersonated both Flare Network and its FXRP token in October. The operators promised monthly returns between 1.5% and 1.8% with principal protection, a guarantee that should have raised red flags but proved effective enough to attract 71 victims who collectively transferred 3.4 million XRP (worth 12.3 billion won, or roughly $8.5 million at the time) into wallets controlled by the perpetrators.
Two 29-year-old men have been referred to prosecutors on aggravated fraud charges. A third suspect, 34, who posed as a legitimate project representative in promotional YouTube videos, faces fraud charges. A fourth man, also 29, remains at large under an Interpol Red Notice.
How the Scam Exploited Due Diligence
What distinguished this operation from amateur efforts was its methodical approach to manufacturing credibility. The group seeded false information across multiple channels: portal blogs, online news articles, and even Wikipedia entries. They produced YouTube content featuring a paid actor vouching for the project’s legitimacy, creating the appearance of independent verification that prospective investors might encounter during routine research.
The timing was deliberate. FXRP had launched legitimately just a month earlier, giving the fake site a real project to impersonate and allowing it to ride momentum from genuine interest in the token.
The site operated for eight days before shutting down on October 23. Investors discovered they had been directed to move XRP off domestic South Korean exchanges, route the funds through overseas venues, and deposit them into wallets the fraudsters controlled—a routing mechanism designed to obscure the funds’ destination and complicate recovery.
The Money Trail
Police investigation revealed the fraud was substantially larger than the confirmed victim losses suggest. Authorities traced 27.3 billion won ($18.8 million) across wallets linked to the group—nearly double the 12.3 billion won that victims reported losing. The discrepancy points to additional unreported victims or multiple rounds of targeting.
Of that $18.8 million traced, authorities froze 17.3 billion won (roughly $11.9 million) across overseas exchanges. Another 10 billion won (approximately $6.9 million) moved during the investigation and remains unaccounted for, suggesting the operators had prepared channels for rapid fund dispersal once the scheme was exposed.
The average loss per victim reached 173 million won—about $119,000—a substantial sum that underscores XRP’s concentrated appeal to retail investors seeking alternative yield opportunities outside traditional finance.
An overseas cryptocurrency exchange first alerted Seoul police to the surge in staking-related fraud, triggering the investigation. Officers executed 54 search and seizure warrants, arrested one suspect at a hideout after his return from abroad, and apprehended the others in sequence. None of the four has been tried, and authorities have not disclosed their identities publicly.
Broader Context: South Korea’s Crypto Enforcement Push
This case represents part of a wider enforcement campaign by South Korean law enforcement against crypto-related financial crime. In June, police charged 23 people over a $11.1 million USDT laundering operation linked to a Cambodia-based phishing ring. Seoul police have publicly committed to treating crypto fraud with “zero tolerance” and urged investors to verify projects through official sources before transferring funds.
The XRP scam illustrates a structural vulnerability in the cryptocurrency market: the ease with which legitimate-sounding projects can be cloned, and the difficulty retail investors face in distinguishing real opportunities from fabrications, particularly when searching online without institutional resources or risk management frameworks.